feat(main): add commit_mode dispatch toggle (latest default)

Add a commit_mode workflow_dispatch input (latest/verified). Latest
(default) keeps the existing branch-tip resolution. Verified is stubbed
to identical behavior for now, with a placeholder for audited pin tables
to be filled in later.

.github/workflows/main.yml

@@ -32,6 +32,14 @@ on:
         description: "Kernel Branding"
         type: string
         default: Wild
+      commit_mode:
+        description: "verified = audited pinned SHAs (pending), latest = branch tips at run time"
+        required: false
+        type: choice
+        options:
+          - latest
+          - verified
+        default: latest
       root_flavor:
         description: "Root Flavor"
         type: choice
@@ -145,6 +153,12 @@ jobs:
         run: |
           set -euo pipefail
 
+          # Commit resolution mode. 'latest' (default) resolves branch tips at
+          # run time via git ls-remote. 'verified' mode is stubbed to the same
+          # behavior until audited pin tables are filled in.
+          COMMIT_MODE="${{ inputs.commit_mode }}"
+          echo "commit_mode=${COMMIT_MODE}"
+
           retry() {
             local n=0
             until [ "$n" -ge 5 ]; do